0

I know that you can add hostnames to /etc/hosts so that resolving them doesn't actually perform a DNS lookup. This would be a line such as

123.45.67.89 myhostname

My question is, what can I set the first part (IP address) to so that any attempted connection to this myhostname will always fail?

Edit: By fail, I mean an explicit ICMP rejection if possible. I don't want to wait for a timeout.

Reason

I have a VM instance running somewhere, sometimes. The cloud server sets a different IP on every launch and I'm not paying for any public domain name. I have a script that launches the instance and adds a line to /etc/hosts so I can easily ssh or open a browser tab to this host using myhostname.

That all works great, but I'd like to also remove this entry when the instance is killed, and have attempted connections to myhostname not incur any DNS lookups or (worse) try to connect to some same-named host on whatever local domain I'm sitting in at the moment.

3
  • You could set the ip to 127.0.1.1 or anything within 127.0.0.0/8 which will resolve to your local machine.
    – sapensadler
    Jan 31, 2018 at 10:55
  • 1
    In what way would you like the connection to fail? Failure to get any response or an explicit ICMP rejection?
    – Torin
    Jan 31, 2018 at 11:22
  • @TorinCarey An explicit reject packet would be better. I edited the question to say that.
    – Dan R
    Jan 31, 2018 at 15:18

2 Answers 2

Reset to default
4

So you want an IP address that a) is guaranteed not to match anything remote and b) will reject everything.

Make one:

iptables -I INPUT 1 -i lo -d 127.66.66.66 -p tcp -j REJECT --reject-with tcp-reset
iptables -I INPUT 2 -i lo -d 127.66.66.66 -j REJECT

(or whatever is the equivalent for your iptables firewall management tool of choice.)

Now all TCP connections to 127.66.66.66 will get a TCP RST packet in response, and everything else gets an ICMP rejection. (TCP RST will generally refuse a TCP connection even faster than ICMP, in my experience.)

IP address 127.66.66.66 is within the loopback segment, so it is guaranteed not to interfere with anything non-local.

1

I can't find a way to have hosts force a "not found" response, I think you'd need to have your own DNS server for that. But you could do some other things...

  • Use an IP address of 127.0.0.1 (or anything in 127/8, really) to make the name point to your local host. For a service you're not running, your system would reply with a TCP reset or an error or drop the packet, but if you're running SSH locally, it wouldn't work that well.

  • Use any of the private-use addresses, like something in 10/8. Depending on your configuration, your system may try to send packets to them, but your ISP should drop the packets before they get very far. Or you could just have your firewall reject them before they leave your machine.

  • Use something that's practically an invalid address. 0.0.0.1 (or anything in 0/8 except 0.0.0.0) seems to produce an error on connect in Linux and Windows. 0.0.0.0 is used e.g. DHCP clients before they know their own address, and seems to direct to localhost on Linux. (The whole block is actually reserved to mean "This host on this network".)

Of course all of these are basically lies, and not the cleanest of solutions as such.

5
  • 2
    Addresses from the blocks reserved for documentation (RFC 5737) is also a possibility. "The blocks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3) are provided for use in documentation. Addresses within the TEST-NET-1, TEST-NET-2, and TEST-NET-3 blocks SHOULD NOT appear on the public Internet."
    – Johan Myréen
    Jan 31, 2018 at 12:53
  • @JohanMyréen, yep, that and a bunch of other choices, that more or less shouldn't be used. But I'm not sure if they're any "better" than the private-use blocks in that the OS would prevent the packets from leaving the system.
    – ilkkachu
    Jan 31, 2018 at 13:03
  • localhost addresses 127/8 are not ideal, because as you mentioned I will have ssh running on the local machine for example. The local subnets like 10/8 are also not ideal because there could be a machine on the local network with that address.
    – Dan R
    Jan 31, 2018 at 15:21
  • Maybe the best solution is to pick an arbitrary IP address (maybe one in 10/8) at random, then setup a static firewall rule to reject all outgoing traffic to that IP. This breaks if I unluckily pick a legitimate IP that I want to connect to, but the probability of doing that should be negligible. Still feels like a "dirty" solution though.
    – Dan R
    Jan 31, 2018 at 15:22
  • @DanRoche, of course you'd pick an address from a block you know your site doesn't use. There's what, 16M addresses in 10/8, 1M in 172.16/12 and 64k in 192.168/16. Probably not that many sites that need all of them... :)
    – ilkkachu
    Jan 31, 2018 at 15:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .